CVE-2023-38871 Economizzer user enumeration vulnerability
An attacker can enumerate valid users or emails via login and password reset responses, potentially aiding further attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38871?
CVE-2023-38871 is a medium-severity vulnerability in n/a, published on 28 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.
Weakness: CWE-203
Which versions are affected by CVE-2023-38871?
2 open source packages ship an affected version, including gugoan/economizzer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gugoan/economizzer Packagist | All versions to 0.9-beta1 | None |
gugoan/economizzer Packagist | All versions to 0.9-beta1 | None |
Products include Economizzer Economizzer.
How do I fix CVE-2023-38871?
No fix has been published for CVE-2023-38871 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38871 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38871 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h3qf-v68r-35jg.